Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

People who like this

1 Answer

You are absolutely right - there is a bug here. The Events module will incorporate the postprocess search when it makes its requests, but if the postprocess search changes later on and nothing else upstream changes, the Events module will not realize it should re-request the events. This is a bug and I'll fix it in the next release. Thanks.

Original Answer:

The Events module does indeed work with postprocess searches. However events and postprocess searches are very tricky to work with together at the Splunk API level. Read the Sideview Utils App's "Introduction to PostProcess" docs page carefully. That page will walk you through the pitfalls associated with using postProcess searches, and those pitfalls get much easier to fall into when you're dealing with a 'raw events' search.

Specifically, what's probably happening is that your postProcess search is referencing one or more extracted fields, but those fields are not referenced explicitly in the syntax of the base search. When this happens splunkd will optimize it away at search dispatch time - those fields will be neither extracted nor preserved. Then when the postprocess search tries to filter by that field it is not there. However it could also be one of the other pitfalls potentially. The page can tell you more. While sometimes you can fix these shenanigans around raw events + postprocess by putting a fields clause into your base search (or tacking one on for the user behind the scenes), it's important to be aware of all the pitfalls involved.

I can't see it being an issue with the postProcess. The corresponding Table and HTML modules that use the same postProcess work fine. My result set is less than 10,000 and the base search grabs every single field that is referenced.

If anything, it looks like the events module fails to update when parameters from above are changed.

You are absolutely right. It will incorporate the postprocess search when it makes its requests, but if the postprocess search changes later on and nothing else changes, it does not know to re-request events. This is a bug and I'll fix it in the next release. Thanks.